CALIFORNIAAccidentalHealthcareFinancial ServicesManufacturingMisdeliveryBusiness Associate (HIPAA)Customer Data InvolvedIdentity (basic)Government IDHealth (basic)CriticalResolved

GILEAD SCIENCES, INC.

bd_62601c63fa842b76 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Feb 18, 2025

Filed

Apr 2, 2025

To disclose

—

Affected

12,224

Linked

5 filings

Confidence

97%

Full breach record for GILEAD SCIENCES, INC. →2 incidents on file

Gilead Sciences, Inc. (CA, Health Plan) reported to HHS on 2025-04-02 an Unauthorized Access/Disclosure affecting 12,224 individuals. The covered entity's business associate made individuals' PHI viewable during mailing. Exposed information included names, addresses, and Social Security numbers. Breached information located on Paper/Films. The CE notified HHS, the media, and affected individuals, and provided free credit monitoring.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 6 weeks / 43 days

Feb 18, 2025

Discovered

Apr 2, 2025

Filed

This filing is one of 5 filings about the same incident.View merged incident

Part of Billing Document Specialists supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_1aded82ca327dbab2025-04-02Verified
Indiana State AGbd_51cb736a09bb847d2025-04-02Verified
Massachusetts State AGbd_8127a6bb544cf3682025-04-02Verified
Maine State AGbd_bea1e4d72777aec22025-04-02Verified

Name: GILEAD SCIENCES, INC.
norm: gilead sciences
Domain: gilead.com
Industry: Insurance — Health

Name: GILEAD SCIENCES, INC.
norm: gilead sciences
Domain: gilead.com
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial Servicesllm

Discovered: Feb 18, 2025
Materiality determined: —
Notification sent: —
Affected individuals: 12,224nationwide
Data types: Identity (basic)Government IDHealth (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Health planBusiness associate involved
Attack vector: Unauthorized Access
Threat actor: Partner
Regulator citations: HHS OCR breach notification submitted 2025-04-02Media notification made

During the incident: Notified HHS
Notified affected media
Notified affected individuals
Provided free credit monitoring to affected individuals
Changes made: Free credit monitoring provided to affected individuals
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 18, 2025
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Feb 18, 2025
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 18, 2025 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Feb 18, 2025 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

California State AGApr 2 · first

Indiana State AGApr 2 · first

Massachusetts State AGApr 2 · first

Maine State AGApr 2 · first

HHS OCRApr 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 2, 2025
Raw hash: 314605de62ab2961d3b906eac6d44fd819566ce1d2cec87c8d62a274b4c1be74

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.4 KB

Download View at source

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityGILEAD SCIENCES, INC.

Victim entityGILEAD SCIENCES, INC.

Incidentdiscovered Feb 18, 2025

Stated responseNotified HHS

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing